top level restructure

modules/features/default.nix

@@ -0,0 +1,104 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig = with lib; {
+            host = mkOption {
+                type = with types; nullOr str;
+                default = null;
+            };
+            graphical = mkOption {
+                type = with types; bool;
+                default = config.hardware.graphics.enable;
+            };
+            remoteBuildHost = mkOption {
+                type = with types; bool;
+                default = false;
+            };
+            remoteBuildClient = mkOption {
+                type = with types; bool;
+                default = false;
+            };
+        };
+
+        imports = [
+            inputs.sops-nix.nixosModules.sops
+        ];
+
+        config = {
+
+            networking.hostName = lib.mkDefault config.sysconfig.host;
+
+            nix = {
+                nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+                channel.enable = false;
+                settings = {
+                    experimental-features = [ "nix-command" "flakes" ];
+                    builders-use-substitutes = lib.mkIf config.sysconfig.remoteBuildClient true;
+                    trusted-users = lib.mkIf config.sysconfig.remoteBuildHost [ "remote-builder" ];
+
+                    substituters = lib.mkIf config.sysconfig.programs.hyprland.enable ["https://hyprland.cachix.org"];
+                    trusted-substituters = lib.mkIf config.sysconfig.programs.hyprland.enable ["https://hyprland.cachix.org"];
+                    trusted-public-keys = lib.mkIf config.sysconfig.programs.hyprland.enable ["hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="];
+                };
+
+                distributedBuilds = config.sysconfig.remoteBuildClient;
+                buildMachines = lib.mkIf config.sysconfig.remoteBuildClient [
+                {
+                    hostName = "esotericbytes.com";
+                    sshUser = "remote-builder";
+                    sshKey = config.sops.secrets."remoteBuildKey".path;
+                    supportedFeatures = [
+                        "nixos-test"
+                            "benchmark"
+                            "big-parallel"
+                            "kvm"
+                    ];
+                    systems = [ "x86_64-linux" "aarch64-linux" ];
+                }
+                ];
+            };
+
+            users.users."remote-builder" = lib.mkIf config.sysconfig.remoteBuildHost {
+                isNormalUser = true;
+                createHome = false;
+            };
+
+            sops.templates."remote-builder" = lib.mkIf config.sysconfig.remoteBuildHost {
+                content = builtins.concatStringsSep ''''\n'' (builtins.map 
+                        (y: config.sops.placeholder.${y}) 
+                        (builtins.filter 
+                         (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                         (builtins.attrNames config.sops.secrets)
+                        )
+                        );
+                path = "/etc/ssh/authorized_keys.d/remote-builder";
+                owner = "remote-builder";
+            };
+
+            sops = {
+                age.keyFile = "/var/lib/sops/age/keys.txt";
+                defaultSopsFormat = "yaml";
+            };
+
+            time.timeZone = lib.mkDefault "America/Chicago";
+
+            i18n = lib.mkDefault {
+                defaultLocale = "en_US.UTF-8";
+
+                extraLocaleSettings = {
+                    LC_ADDRESS = "en_US.UTF-8";
+                    LC_IDENTIFICATION = "en_US.UTF-8";
+                    LC_MEASUREMENT = "en_US.UTF-8";
+                    LC_MONETARY = "en_US.UTF-8";
+                    LC_NAME = "en_US.UTF-8";
+                    LC_NUMERIC = "en_US.UTF-8";
+                    LC_PAPER = "en_US.UTF-8";
+                    LC_TELEPHONE = "en_US.UTF-8";
+                    LC_TIME = "en_US.UTF-8";
+                };
+            };
+        };
+    };
+}
+

modules/features/etc/default.nix

@@ -0,0 +1,9 @@
+{ ... }: {
+    
+
+    flake.nixosModules.default = { lib, ... }: {
+
+        config = {
+        };
+    };
+}

modules/features/packages/default.nix

@@ -0,0 +1,11 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { pkgs, ... }: {
+
+        environment.systemPackages = with pkgs; [
+            sops
+            inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko-install 
+        ];
+    };
+}
+

modules/features/programs/hyprland/default.nix

@@ -0,0 +1,35 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.programs.hyprland.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.programs.hyprland.enable {
+
+            sysconfig.services.sddm.enable = lib.mkDefault true;
+
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+            programs.hyprland = let
+                system = pkgs.stdenv.hostPlatform.system;
+                #pkgs-us = import inputs.nixpkgs-us { inherit system; };
+            in {
+                enable = true;
+
+                withUWSM = false;
+
+                xwayland.enable = true;
+
+                systemd.setPath.enable = true;
+
+                package = inputs.hyprland.packages.${system}.hyprland;
+
+                portalPackage = inputs.hyprland.packages.${system}.xdg-desktop-portal-hyprland;
+            };
+        };
+    };
+}
+

modules/features/programs/steam/default.nix

@@ -0,0 +1,18 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.programs.steam.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.programs.steam.enable {
+
+            programs.steam = {
+                enable = true;
+            };
+        };
+    };
+}
+

modules/features/secrets.yaml

@@ -0,0 +1,37 @@
+remoteBuildClientKeys:
+    laptop: ENC[AES256_GCM,data:SZRAZ36nSueWVLcdvpgZpltp/aORqAObFWhgqtIrTYccoK/3F7l0J+VJzF51FASa6spbGJL2BSbzOygyal609pvJc9Hb9bIN85GMzV1P4lha62iC8dkuVLXezPU=,iv:veQJxL4QTxFg2UKm2+I3RQXyuwW2rXEV/gXIQ7nBtlY=,tag:9C9Ltzwz823yY029p9K41A==,type:str]
+    pi4: ENC[AES256_GCM,data:zT7V70DbBj5OIl5dTkUjvdqrxSiPcc+oFvL7R2ZAuytSQWdo9MR+WuuhN1Zeo0Ho9eGcbS+Qwr/Vs+yIYU+XaUlgawHM6aiUXoQmQE/yJFOPYUcmi0R4mxD0nkPZ0w==,iv:HQ+bxpeHZq9cezF6omZ1OMecfOw74pXzBujndhXnLPM=,tag:AM5O21nYzb4xzybOPvBwRg==,type:str]
+    android: ENC[AES256_GCM,data:srkEb7oAxcN5++sTWQo43C8M4JNpfeeJlcGLGUA6gp74kcES1HnIs87ZtCik121oMSYD15LZ8p/x/AV2QdGMobQFxoMQ2NEehhP66n2EoXcEos3BXqUlbphiBGMRfVK9+w==,iv:bmDbVfVSZLU+EsZh/GBBY9QVcfHZJB9gLZYeI3NYoGY=,tag:biE4/DN7z2wRyFBjK7vEnQ==,type:str]
+sops:
+    age:
+        - recipient: age1yqgyp2uxz4lzrc9f9ka0mfjl5fr6ahf8nf24nlmran2wulg6fpvq9hyp9q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSkFZWVVMWHRTSkM3amVY
+            UkR5OHlDdE1ESnd3Wm5sajVodFFnWDhybVVBCnhsZ0w5bWZMOUJKR0RrT1dNTkVW
+            cmMrc0ZyMWhUVXRaYkF3MElsWGJTMnMKLS0tIHdScGVCUFlXMzZiSnp2OGh0RXhu
+            cUFTZmdBU1ViRUthWWhKeXNkKzJIdW8KYKlEW0yjxf2vS/SC8Jt3lw9/+NoAyRlZ
+            WrTY0SMPiIDKObXzohUTr0fKj3cghIzG9dfXJQ9FZFtDAE+ilrvS9Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1640eg0pnmkruc89m5xguz0m8fek44fl4tzez6qwuzlz6kmapqewsp8esxd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRzFSWjU2RnpXcHBHVzlG
+            SVl5aEJRQWlqcTNwQTNCUHR6VkRVTHl5WmpRClVHdzcxeFJ4S3B3MVNpckJvNzkx
+            YmhZR1hDcWdNU2U1eXdzRTAzcGdCUTgKLS0tIGY0MnovTzY0eG9qVGxDQXF2dVI2
+            N2IvdjR1a2xUb3g5ZG9KdW14WS9wcEUK53smO1nk5+PeY6eW5DMLpspAUkGOVnxB
+            AvQmczyKI2SgL4TA/luHAYDPLrnAZHlHenqDPh9jtWrvKfJLv6W1vw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12pnf36uqesjmy3e0lythfnpwam3zg5mv8m936fc4jphy4ces2fdqwn0s74
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcG5GMDFNWitQbmdQVEV5
+            NFRIOWR1ODFIZEh2SUNmYlBZUUxVWlZpeDMwCnpoWS9jc1U3blREZEMvMjFvczZw
+            TGI4N2xoMTNSY2kxZkZGdGVrTHRNRlkKLS0tIEQ2V1cveDJrZmEwWmhqV1QweHJM
+            NXNhczV5Y3o3dmJ2RVk3eDBRd1FDdEkK4ELlB6suN3R3GJ6XRQCvE9mgiXUOMFs3
+            Yi+VfJTi3pkUQEi8MZP64Nl6IR5dXjUoPXFhBNcplmLf09JDjH4LJQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-26T22:28:31Z"
+    mac: ENC[AES256_GCM,data:hTEenm/UO84leu7alRdWlicKKrwNlaRR7ZQzhDtOCUcXemvwe30WkSq2mdzOnSo0uMSg1HZIlna8oRUd31ENe1aWfl69PlYPxEicmN5UHykVboXydw6m0yPoAqHj+nqG/vkWsVp0JN8HvTc59mzD+1DfydhJA3m0juaa81w5GsY=,iv:HBkE78QhX1wZANpvDW7nOIOTKBdCv0/dUc1Xv5+OQmQ=,tag:6I2z8MgZxnXjqd4iikA9nQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2

modules/features/services/aurora-greeter/default.nix

@@ -0,0 +1,16 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.aurora-greeter = { config, lib, pkgs, ... }: {
+
+        imports = [
+            inputs.aurora.nixosModules.default
+        ];
+
+        config = {
+
+            services.aurora-greeter = {
+                enable = true;
+            };
+        };
+    };
+}

modules/features/services/avahi/default.nix

@@ -0,0 +1,27 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options = {
+            sysconfig.services.avahi.enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.services.avahi.enable {
+
+            services.avahi = {
+
+                enable = true;
+                ipv4 = true;
+                ipv6 = true;
+                openFirewall = true;
+                nssmdns4 = true;
+                wideArea = true;
+
+            };   
+        };
+    };
+}
+

modules/features/services/dynamicDNS/default.nix

@@ -0,0 +1,44 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.services.dynamicDNS.enable = with lib; mkOption {
+
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.services.dynamicDNS.enable {
+
+            systemd.timers.dynamicDNS = {
+
+                wantedBy = [ "timers.target" ];
+
+                timerConfig = {
+
+                    OnBootSec = "5m";
+
+                    OnUnitActiveSec = "1h";
+
+                    Unit = "dynamicDNS.service";
+                };
+            };
+
+            systemd.services.dynamicDNS = {
+
+                name = "dynamicDNS.service";
+
+                serviceConfig = {
+
+                    Type = "oneshot";
+
+                    LoadCredential = [ "cloudflare-api-key" ];
+
+                };
+
+                script = '''';
+            };
+        };
+    };
+}
+

modules/features/services/kdePlasma6/default.nix

@@ -0,0 +1,35 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.services.kdePlasma6.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.services.kdePlasma6.enable {
+
+            services.desktopManager.plasma6.enable = true;
+
+            sysconfig.services.sddm.enable = lib.mkDefault true;
+
+            environment.systemPackages = with pkgs; [
+                kdePackages.discover # Optional: Install if you use Flatpak or fwupd firmware update sevice
+                    kdePackages.kcalc # Calculator
+                    kdePackages.kcharselect # Tool to select and copy special characters from all installed fonts
+                    kdePackages.kcolorchooser # A small utility to select a color
+                    kdePackages.kolourpaint # Easy-to-use paint program
+                    kdePackages.ksystemlog # KDE SystemLog Application
+                    kdePackages.sddm-kcm # Configuration module for SDDM
+                    kdiff3 # Compares and merges 2 or 3 files or directories
+                    kdePackages.isoimagewriter # Optional: Program to write hybrid ISO files onto USB disks
+                    kdePackages.partitionmanager # Optional Manage the disk devices, partitions and file systems on your computer
+                    hardinfo2 # System information and benchmarks for Linux systems
+                    haruna # Open source video player built with Qt/QML and libmpv
+                    wayland-utils # Wayland utilities
+                    wl-clipboard # Command-line copy/paste utilities for Wayland
+            ];
+        };
+    };
+}
+

modules/features/services/netbird/default.nix

@@ -0,0 +1,41 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig = {
+
+            services.netbird.enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = let 
+            pkgs-us = import inputs.nixpkgs-us {
+                system = "x86_64-linux";
+            };
+        in lib.mkIf config.sysconfig.services.netbird.enable {
+
+            services.netbird = {
+                enable = lib.mkDefault config.sysconfig.services.netbird.enable;
+
+                clients.default = {
+                    port = 51820;
+                    name = "netbird";
+                    interface = "wt0";
+                    hardened = false;
+                    
+                    ui = {
+                        enable = lib.mkDefault config.sysconfig.graphical;
+                        #package = pkgs-us.netbird-ui;
+                        #package = pkgs.netbird-ui;
+                    };
+                };
+
+                package = pkgs-us.netbird;
+                #package =   pkgs.netbird;
+            };
+        };
+    };
+}
+

modules/features/services/novnc/default.nix

@@ -0,0 +1,34 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.services.novnc.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.services.novnc.enable {
+            systemd.services.novnc = {
+                enable = true;
+
+                path = with pkgs; [
+                    novnc
+                        ps
+                ];
+
+                script = ''
+                    novnc --listen 80 --vnc 127.0.0.1:5900
+                    '';
+
+                serviceConfig = {
+                    Type = "exec";
+                };
+
+                wantedBy = [ "multi-user.target" ];
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+    };
+}
+

modules/features/services/ollama/default.nix

@@ -0,0 +1,29 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options = {
+            sysconfig.services.ollama.enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.services.ollama.enable {
+            services.ollama = {
+                enable = true;
+                acceleration = "cuda";
+                environmentVariables = {
+                    OLLAMA_CONTEXT_LENGTH = lib.mkDefault "16000";
+                };
+                package = let 
+                    pkgs-us = import inputs.nixpkgs-us { 
+                        system = "x86_64-linux";
+                        config.allowUnfree = true;
+                    }; 
+                in pkgs-us.ollama-cuda;
+            };
+        };
+    };
+}
+

modules/features/services/openssh/default.nix

@@ -0,0 +1,26 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options = {
+            sysconfig.services.openssh.enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf (config.sysconfig.services.openssh.enable || config.sysconfig.remoteBuildHost) {
+
+            services.openssh = {
+                enable = true;
+                openFirewall = lib.mkDefault true;
+                settings = {
+                    PermitRootLogin = lib.mkForce "no";
+                    PasswordAuthentication = false;
+                    KbdInteractiveAuthentication = false;
+                };
+            };
+        };
+    };
+}
+

modules/features/services/pipewire/default.nix

@@ -0,0 +1,54 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options = {
+            sysconfig.services.pipewire.enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.services.pipewire.enable {
+
+# Enable sound with pipewire.
+#sound.enable = true;
+
+            security.rtkit.enable = true;
+            services.pipewire = {
+                enable = true;
+                package = pkgs.pipewire;
+                alsa.enable = true;
+                alsa.support32Bit = true;
+                pulse.enable = true;
+                extraConfig.pipewire-pulse."92-low-latency" = {
+                    context.modules = [
+                    {
+                        name = "libpipewire-module-protocol-pulse";
+                        args = {
+                            pulse.min.req = "32/48000";
+                            pulse.default.req = "32/48000";
+                            pulse.max.req = "32/48000";
+                            pulse.min.quantum = "32/48000";
+                            pulse.max.quantum = "32/48000";
+                        };
+                    }
+                    ];
+                    stream.properties = {
+                        node.latency = "32/48000";
+                        resample.quality = 1;
+                    };
+                };
+# If you want to use JACK applications, uncomment this
+#jack.enable = true;
+
+# use the example session manager (no others are packaged yet so this is enabled by default,
+# no need to redefine it in your config for now)
+                wireplumber.enable = true;
+
+            };
+        };
+
+
+    };
+}

modules/features/services/sddm/default.nix

@@ -0,0 +1,37 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.services.sddm.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.services.sddm.enable {
+
+            qt.enable = true;
+
+            environment.systemPackages = with pkgs; [ (sddm-astronaut.override { embeddedTheme = "pixel_sakura"; }) ];
+
+            services.displayManager.sddm = {
+                enable = true;
+                wayland.enable = true;
+                autoNumlock = true;
+                theme = "sddm-astronaut-theme"; #"${inputs.tokyo-night-sddm-theme { inherit pkgs; }}";
+                enableHidpi = true;
+                /*extraPackages = with pkgs; [
+                  libsForQt5.qtsvg
+                  libsForQt5.qtquickcontrols2
+                  libsForQt5.qtgraphicaleffects
+                  ];*/
+
+                package = lib.mkDefault pkgs.kdePackages.sddm;
+                extraPackages = with pkgs; [
+                    kdePackages.qtsvg
+                        kdePackages.qtvirtualkeyboard
+                        kdePackages.qtmultimedia
+                ];
+            };
+        };
+    };
+}

modules/features/services/wyoming/default.nix

@@ -0,0 +1,69 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.services.wyoming = {
+            enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            piper = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            openwakeword = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            faster-whisper = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            satellite = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.services.wyoming.enable {
+
+            services.wyoming = {
+
+                piper = lib.mkIf config.sysconfig.services.wyoming.piper {
+
+                    servers.piper = {
+                        enable = true;
+                        voice = "en-us-ryan-medium";
+                        uri = "tcp://0.0.0.0:11435";
+                    };
+                };
+
+                openwakeword = lib.mkIf config.sysconfig.services.wyoming.openwakeword {
+                    enable = true;
+                    uri = "tcp://0.0.0.0:11432";
+
+                    threshold = 0.5;
+                    customModelsDirectories = [
+#./wake_words
+                    ];
+                };
+
+                faster-whisper = lib.mkIf config.sysconfig.services.wyoming.faster-whisper {
+                    servers.whisper = {
+                        enable = true;
+                        device = "auto";
+                        language = "en";
+                        model = "medium.en";
+                        uri = "tcp://0.0.0.0:11433";
+                    };
+                };
+
+                satellite = lib.mkIf config.sysconfig.services.wyoming.satellite {
+                    enable = true;
+                    uri = "tcp://0.0.0.0:11431";
+                };
+            };
+
+        };
+    };
+}

modules/features/users/default.nix

@@ -0,0 +1,138 @@
+{ self, ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig = with lib; {
+
+            sshHostKeys = lib.mkOption {
+                type = with lib.types; attrsOf str;
+                default = {};
+            };
+
+            users = let 
+
+                userType = types.submodule ({ name, ... }: {
+                        options = with lib; {
+                        name = mkOption {
+                        type = with types; passwdEntry str;
+                        default = name;
+                        };
+
+                        home-manager = {
+                        enable = mkOption {
+                        type = with types; bool;
+                        default = false;
+                        };
+
+                        standalone = mkOption {
+                        type = with types; bool;
+                        default = true;
+                        description = "is this home-manager standalone?";
+                        };
+
+                        extraModules = mkOption {
+                        type = with types; listOf raw;
+                        default = [];
+                        };
+                        };
+
+                        isSuperuser = mkOption {
+                            type = with types; bool;
+                            default = false;
+                            description = "sudo?";
+                        };
+
+                        usePresets = mkOption {
+                            type = with types; bool;
+                            default = true;
+                            description = "search for predefined settings?";
+                        };
+
+                        ssh = {
+                            keys = mkOption {
+                                type = with types; listOf str;
+                                default = [];
+                                description = "public keys used to login as this user";
+                            };
+
+                            hosts = mkOption {
+                                type = with types; listOf str;
+                                default = [];
+                                description = "user@host's used to login as this user";
+                            };
+                        };
+
+
+                        uid = mkOption {
+                            type = with types; nullOr int;
+                            default = null;
+                        };
+
+                        hashedPasswordFile = mkOption {
+                            type = with types; nullOr str;
+                            default = null;
+                        };
+
+                        extraGroups = mkOption {
+                            type = with types; listOf str;
+                            default = [];
+                        };
+
+                        shell = mkOption {
+                            type = with types; package;
+                            default = pkgs.shadow;
+                        };
+                        };
+                });
+
+            in lib.mkOption {
+                type = with lib.types; attrsOf userType;
+                default = {};
+            };
+        };
+
+
+        config = {
+            users.users = builtins.mapAttrs (x: y: let
+                    cfg = config.sysconfig.users.${x};
+                    in {
+                    name = cfg.name;
+                    isNormalUser = true;
+                    uid = cfg.uid;
+                    hashedPasswordFile = lib.mkIf (cfg.hashedPasswordFile != null) cfg.hashedPasswordFile;
+                    shell = cfg.shell;
+                    extraGroups = cfg.extraGroups ++ (if cfg.isSuperuser then [ "wheel" ] else []);
+                    openssh.authorizedKeys.keys = lib.mkIf config.sysconfig.services.openssh.enable (cfg.ssh.keys ++ (map (z: config.sysconfig.sshHostKeys.${z}) cfg.ssh.hosts));
+                    packages = with pkgs; lib.mkIf (cfg.home-manager.enable && cfg.home-manager.standalone) [ home-manager ];
+                    }) config.sysconfig.users;
+
+            programs.fuse.userAllowOther = true;
+
+            home-manager = {
+                backupFileExtension = "backup";
+                useUserPackages = true;
+                sharedModules = [];
+                users = builtins.listToAttrs (builtins.map 
+                    (x: { 
+                         name = x; 
+                         value = (lib.mkMerge ([
+
+                            (lib.mkIf (self.homeModules ? ${x}) self.homeModules.${x})
+
+                         ] ++ config.sysconfig.users.${x}.home-manager.extraModules));
+                    })
+                    (builtins.filter 
+                         (y: (config.sysconfig.users.${y}.home-manager.enable && !config.sysconfig.users.${y}.home-manager.standalone))
+                         (builtins.attrNames config.sysconfig.users)
+                    )
+                );
+
+            };
+
+            nix.settings.trusted-users = (builtins.filter 
+                (y: config.sysconfig.users.${y}.isSuperuser)
+                (builtins.attrNames config.sysconfig.users)
+            );
+        };
+    };
+}

modules/features/users/nathan/default.nix

@@ -0,0 +1,27 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        config = lib.mkIf (
+            config.sysconfig.users ? nathan && config.sysconfig.users.nathan.usePresets
+        ) {
+
+            sops.secrets."nathan/pass".neededForUsers = true;
+
+            users.users.nathan = {
+                shell = lib.mkDefault pkgs.zsh;
+                name = lib.mkDefault "nathan";
+                isNormalUser = lib.mkDefault true;
+#hashedPasswordFile = lib.mkIf (cfg.hashedPasswordFile != null) cfg.hashedPasswordFile;
+                extraGroups = [ "networkmanager" "docker" "libvirtd" ];
+                openssh.authorizedKeys.keys = with config.sysconfig.users.nathan; lib.mkIf config.sysconfig.services.openssh.enable (
+                        ssh.keys ++ (map (z: config.sysconfig.sshHostKeys.${z}) ssh.hosts)
+                        );
+                packages = lib.mkIf (
+                        config.sysconfig.users.nathan.home-manager.enable && config.sysconfig.users.nathan.home-manager.standalone
+                        ) [ pkgs.home-manager ];
+
+            };
+        };
+    };
+}

modules/features/virtualization/containers/code-server/default.nix

@@ -0,0 +1,44 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers.code-server.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.code-server.enable {
+
+            containers.code-server = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.31";
+
+                config = {
+
+                    services.code-server = {
+                        enable = true;
+
+                        hashedPassword = "1$WFYzcW1TNmpYM1ZKU3lielNCaXAyRkF2K3FjPQ$bSeeV4bvL2uiDYKiQjBLJPAO13/gNjYVgw8YKFtTQDI";
+
+                        disableUpdateCheck = true;
+
+                        disableTelemetry = true;
+
+                        disableGettingStartedOverride = true;
+
+                        auth = "none";
+
+                        host = "0.0.0.0";
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 4444 ];
+
+                    system.stateVersion = "25.05";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/gitea/default.nix

@@ -0,0 +1,115 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers.gitea.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.gitea.enable {
+
+            networking = {
+                nat.internalInterfaces = [ "ve-gitea" ];
+            };
+
+            sops.secrets = {
+                "gitea/dbpass" = {};
+            };
+
+            containers.gitea = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.20";
+
+                bindMounts = {
+                    "/etc/gitea/data" = {
+                        hostPath = "/ssd1/Gitea/data";
+                        isReadOnly = false;
+                    };
+                };
+
+                extraFlags = [
+                    "--load-credential=dbpass:${config.sops.secrets."gitea/dbpass".path}"
+                ];
+                
+                config = {
+
+                    systemd.services.secrets_setup = {
+                        wantedBy = [ "gitea.service" ];
+
+                        serviceConfig = {
+                            LoadCredential = [
+                                "dbpass"
+                            ];
+                        };
+
+                        script = ''
+                            cat ''${CREDENTIALS_DIRECTORY}/dbpass > /etc/gitea/dbpass
+                            chown gitea:gitea /etc/gitea/*
+                        '';
+                    };
+
+                    services.gitea = {
+                        enable = true;
+
+                        stateDir = "/etc/gitea/data";
+
+                        dump.enable = false;
+
+                        appName = "Gitea";
+
+                        settings = {
+                            server = {
+                                DOMAIN = "gitea.esotericbytes.com";
+                                HTTP_PORT = 3000;
+                                ROOT_URL = "https://gitea.esotericbytes.com/";
+                            };
+                            service = {
+                                DISABLE_REGISTRATION = false;
+                                ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+                                REQUIRE_SIGNIN_VIEW = false;
+                            };
+                            oauth2_client = {
+                                ENABLE_AUTO_REGISTRATION = true;
+                            };
+                            session.COOKIE_SECURE = true;
+
+                            cron = {
+                                ENABLED = true;
+                                RUN_AT_START = true;
+                            };
+
+                            repository = {
+                                DEFAULT_BRANCH = "master";
+                            };
+                        };
+
+                        database = {
+                            passwordFile = "/etc/gitea/dbpass";
+                            type = "postgres";
+                        };
+
+                    };
+
+                    services.openssh = {
+                        enable = true;
+                        openFirewall = true;
+                        settings = {
+                            PermitRootLogin = lib.mkForce "no";
+                            PasswordAuthentication = false;
+                            KbdInteractiveAuthentication = false;
+                        };
+                        ports = [ 2222 ];
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 3000 ];
+
+                    system.stateVersion = "24.11";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/nginx/default.nix

@@ -0,0 +1,46 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers."esotericbytes.com".enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers."esotericbytes.com".enable {
+
+            containers.esotericbytes-com = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.13";
+
+                bindMounts = {
+                    "/var/www/data" = {
+                        hostPath = "/ssd1/esotericbytes-com/data";
+                        isReadOnly = false;
+                    };
+                };
+
+                config = {
+
+                    services.nginx = {
+                        enable = true;
+                        virtualHosts = {
+                            "esotericbytes.com" = {
+                                enableACME = false;
+                                forceSSL = false;
+                                root = "/var/www/data";
+                            };
+                        };
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "24.05";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/novnc/default.nix

@@ -0,0 +1,55 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.containers.novnc.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.novnc.enable {
+
+            networking = {
+                firewall.interfaces."ve-novnc" = {
+                    allowedTCPPorts = [ 5900 ];
+                    allowedUDPPorts = [ 5900 ];
+                };
+            };
+
+            containers.novnc = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.30";
+
+                config = {
+
+                    systemd.services.novnc = {
+                        enable = true;
+
+                        path = with pkgs; [
+                            novnc
+                                ps
+                        ];
+
+                        script = ''
+                            novnc --listen 80 --vnc 192.168.100.10:5900
+                            '';
+
+                        serviceConfig = {
+                            Type = "exec";
+                        };
+
+                        wantedBy = [ "multi-user.target" ];
+                    };
+
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "25.05";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/ntfy/default.nix

@@ -0,0 +1,46 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers.ntfy.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.ntfy.enable {
+
+            containers.ntfy = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.19";
+
+                config = {
+
+                    services.ntfy-sh = {
+
+                        enable = true;
+
+                        settings = {
+
+                            base-url = "https://ntfy.esotericbytes.com";
+
+                            listen-http = ":80";
+
+                            behind-proxy = true;
+
+                            upstream-base-url = "https://ntfy.sh";
+
+                            auth-default-access = "deny-all";
+                        };
+                    };
+
+                    networking.firewall.allowedTCPPorts = [ 80 ];
+
+                    system.stateVersion = "24.05";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/rustdesk/default.nix

@@ -0,0 +1,88 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers.rustdesk.enable = lib.options.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.rustdesk.enable {
+
+            /*networking = {
+              firewall.allowedTCPPorts = [ 21115 21116 21117 21118 21119 ];
+              firewall.allowedUDPPorts = [ 21116 ];
+              };*/
+            containers.rustdesk = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.27";
+                /*            forwardPorts = [
+                              {
+                              containerPort = 21115;
+                              hostPort = 21115;
+                              protocol = "tcp";
+                              }
+                              {
+                              containerPort = 21116;
+                              hostPort = 21116;
+                              protocol = "tcp";
+                              }
+                              {
+                              containerPort = 21116;
+                              hostPort = 21116;
+                              protocol = "udp";
+                              }
+                              {
+                              containerPort = 21117;
+                              hostPort = 21117;
+                              protocol = "tcp";
+                              }
+                              {
+                              containerPort = 21118;
+                              hostPort = 21118;
+                              protocol = "tcp";
+                              }
+
+                              {
+                              containerPort = 21119;
+                              hostPort = 21119;
+                              protocol = "tcp";
+                              }
+
+
+                              ];*/
+                config = {
+
+                    services.rustdesk-server = {
+                        enable = true;
+
+                        openFirewall = true;
+
+                        relay = {
+                            enable = true;
+                            extraArgs = [ 
+                                "-k" 
+                                "AAAAC3NzaC1lZDI1NTE5AAAAIIPztDjwgB3xCza5+p5z1jpGVYoVQNl3fqD69pPCm0NA"
+                            ];
+                        };
+
+                        signal = {
+                            enable = true;
+#relayHosts = [ "esotericbytes.com" ];
+                            relayHosts = [ "192.168.100.27" ];
+                            extraArgs = [
+                                "-k"
+                                    "AAAAC3NzaC1lZDI1NTE5AAAAIIPztDjwgB3xCza5+p5z1jpGVYoVQNl3fqD69pPCm0NA"
+                            ];
+                        };
+                    };
+
+                    system.stateVersion = "24.05";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/containers/sandbox/default.nix

@@ -0,0 +1,82 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, self, ... }: {
+
+        options.sysconfig.containers.sandbox.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.containers.sandbox.enable {
+
+            networking = {
+
+                nat.internalInterfaces = [ "ve-sandbox" ];
+            };
+            containers.sandbox = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.32";
+
+                ephemeral = true;
+
+                timeoutStartSec = "3min";
+
+                flake = "${self}";
+
+                /*bindMounts = {
+                  "/dev/nvidia0" = {
+                  hostPath = "/dev/nvidia0";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidiactl" = {
+                  hostPath = "/dev/nvidiactl";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-uvm" = {
+                  hostPath = "/dev/nvidia-uvm";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-modeset" = {
+                  hostPath = "/dev/nvidia-modeset";
+                  isReadOnly = false;
+                  };
+                  "/dev/nvidia-uvm-tools" = {
+                  hostPath = "/dev/nvidia-uvm-tools";
+                  isReadOnly = false;
+                  };
+                  };
+
+                  allowedDevices = [
+                  {
+                  node = "/dev/nvidia0";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidiactl";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-uvm";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-modeset";
+                  modifier = "rw";
+                  }
+                  {
+                  node = "/dev/nvidia-uvm-tools";
+                  modifier = "rw";
+                  }
+                  ];*/
+
+                config = {
+                };
+
+
+            };
+        };
+    };
+}

modules/features/virtualization/containers/wyoming/default.nix

@@ -0,0 +1,134 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.containers.wyoming = {
+            enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            piper = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            openwakeword = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            faster-whisper = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+            satellite = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.containers.wyoming.enable {
+
+            containers.wyoming = {
+
+                autoStart = true;
+                privateNetwork = true;
+                hostAddress = "192.168.100.10";
+                localAddress = "192.168.100.26";
+
+                bindMounts = lib.mkIf config.sysconfig.containers.wyoming.faster-whisper {
+                    "/dev/nvidia0" = {
+                        hostPath = "/dev/nvidia0";
+                        isReadOnly = false;
+                    };
+                    "/dev/nvidiactl" = {
+                        hostPath = "/dev/nvidiactl";
+                        isReadOnly = false;
+                    };
+                    "/dev/nvidia-uvm" = {
+                        hostPath = "/dev/nvidia-uvm";
+                        isReadOnly = false;
+                    };
+                    "/dev/nvidia-modeset" = {
+                        hostPath = "/dev/nvidia-modeset";
+                        isReadOnly = false;
+                    };
+                    "/dev/nvidia-uvm-tools" = {
+                        hostPath = "/dev/nvidia-uvm-tools";
+                        isReadOnly = false;
+                    };
+                };
+
+                allowedDevices = lib.mkIf config.sysconfig.containers.wyoming.faster-whisper [
+                {
+                    node = "/dev/nvidia0";
+                    modifier = "rw";
+                }
+                {
+                    node = "/dev/nvidiactl";
+                    modifier = "rw";
+                }
+                {
+                    node = "/dev/nvidia-uvm";
+                    modifier = "rw";
+                }
+                {
+                    node = "/dev/nvidia-modeset";
+                    modifier = "rw";
+                }
+                {
+                    node = "/dev/nvidia-uvm-tools";
+                    modifier = "rw";
+                }
+                ];
+
+                config = {
+
+                    networking.firewall = {
+                        allowedTCPPorts = [ 11431 11432 11433 11435 ];
+                    };
+
+                    services.wyoming = {
+
+                        piper = lib.mkIf config.sysconfig.containers.wyoming.piper {
+
+                            servers.piper = {
+                                enable = true;
+                                voice = "en-us-ryan-medium";
+                                uri = "tcp://0.0.0.0:11435";
+                            };
+                        };
+
+                        openwakeword = lib.mkIf config.sysconfig.containers.wyoming.openwakeword {
+                            enable = true;
+                            uri = "tcp://0.0.0.0:11432";
+
+                            threshold = 0.5;
+                            customModelsDirectories = [
+#./wake_words
+                            ];
+                        };
+
+                        faster-whisper = lib.mkIf config.sysconfig.containers.wyoming.faster-whisper {
+                            servers.whisper = {
+                                enable = true;
+                                device = "auto";
+                                language = "en";
+                                model = "medium.en";
+                                uri = "tcp://0.0.0.0:11433";
+                            };
+                        };
+
+                        satellite = lib.mkIf config.sysconfig.containers.wyoming.satellite {
+                            enable = true;
+                            uri = "tcp://0.0.0.0:11431";
+#user = "nathan";
+                            vad.enable = false;
+                        };
+                    };
+
+                    system.stateVersion = "25.05";
+                };
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/authentik/default.nix

@@ -0,0 +1,241 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    hostPort = 9005;
+
+    subdomain = "auth";
+
+    name = "authentik";
+
+    in {
+
+        options.sysconfig.docker.authentik.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.authentik.enable && config.sysconfig.docker.enable) {
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            sops.secrets = {
+                "authentik/pass" = {};
+                "authentik/secret_key" = {};
+            };
+
+            sops.templates."authentik.env" = {
+                content = ''
+                    PG_PASS=${config.sops.placeholder."authentik/pass"}
+                SECRET_KEY=${config.sops.placeholder."authentik/secret_key"}
+                '';
+            };
+
+            virtualisation.oci-containers.containers."authentik-postgresql" = {
+                image = "docker.io/library/postgres:16-alpine";
+                environment = {
+                    "POSTGRES_DB" = "authentik";
+                    "POSTGRES_PASSWORD" = "\${PG_PASS}";
+                    "POSTGRES_USER" = "authentik";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                volumes = [
+                    "authentik_database:/var/lib/postgresql/data:rw"
+                ];
+                log-driver = "journald";
+                extraOptions = [
+                    "--health-cmd=pg_isready -d \${POSTGRES_DB} -U \${POSTGRES_USER}"
+                        "--health-interval=30s"
+                        "--health-retries=5"
+                        "--health-start-period=20s"
+                        "--health-timeout=5s"
+                        "--network-alias=postgresql"
+                        "--network=authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-postgresql" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                        "docker-volume-authentik_database.service" 
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                        "docker-volume-authentik_database.service" 
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."authentik-server" = {
+                image = "ghcr.io/goauthentik/server:2025.12.2";
+                environment = {
+                    "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
+                    "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+                    "AUTHENTIK_POSTGRESQL__PASSWORD" = "\${PG_PASS}";
+                    "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+                    "AUTHENTIK_SECRET_KEY" = "\${SECRET_KEY}";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.101.1:${builtins.toString hostPort}";
+
+
+                    "traefik.http.middlewares.authentik.forwardauth.address" = "https://auth.esotericbytes.com/outpost.goauthentik.io/auth/traefik";
+                    "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+                    "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
+
+                };
+                volumes = [
+                    "/etc/Authentik/custom-templates:/templates:rw"
+                        "/etc/Authentik/data:/data:rw"
+                ];
+                ports = [
+                    "${builtins.toString hostPort}:9000/tcp"
+#"9443:9443/tcp"
+                ];
+                cmd = [ "server" ];
+                dependsOn = [
+                    "authentik-postgresql"
+                ];
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=server"
+                        "--network-alias=authentik-server"
+                        "--network-alias=${name}"
+                        "--ip=192.168.101.6"
+                ];
+                networks = [
+                    "docker-main"
+                        "authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-server" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                        "docker-network-setup.service" 
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                        "docker-network-setup.service" 
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."authentik-worker" = {
+                image = "ghcr.io/goauthentik/server:2025.12.2";
+                environment = {
+                    "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
+                    "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+                    "AUTHENTIK_POSTGRESQL__PASSWORD" = "\${PG_PASS}";
+                    "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+                    "AUTHENTIK_SECRET_KEY" = "\${SECRET_KEY}";
+                };
+                environmentFiles = [ config.sops.templates."authentik.env".path ];
+                volumes = [
+                    "/etc/Authentik/certs:/certs:rw"
+                        "/etc/Authentik/custom-templates:/templates:rw"
+                        "/etc/Authentik/data:/data:rw"
+                        "/var/run/docker.sock:/var/run/docker.sock:rw"
+                ];
+                cmd = [ "worker" ];
+                dependsOn = [
+                    "authentik-postgresql"
+                ];
+                user = "root";
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=worker"
+                        "--network=authentik_default"
+                ];
+            };
+            systemd.services."docker-authentik-worker" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-authentik_default.service"
+                ];
+                requires = [
+                    "docker-network-authentik_default.service"
+                ];
+                partOf = [
+                    "docker-compose-authentik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-authentik-root.target"
+                ];
+            };
+
+# Networks
+            systemd.services."docker-network-authentik_default" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                    ExecStop = "docker network rm -f authentik_default";
+                };
+                script = ''
+                    docker network inspect authentik_default || docker network create authentik_default
+                    '';
+                partOf = [ "docker-compose-authentik-root.target" ];
+                wantedBy = [ "docker-compose-authentik-root.target" ];
+            };
+
+# Volumes
+            systemd.services."docker-volume-authentik_database" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect authentik_database || docker volume create authentik_database --driver=local
+                    '';
+                partOf = [ "docker-compose-authentik-root.target" ];
+                wantedBy = [ "docker-compose-authentik-root.target" ];
+            };
+
+# Root service
+# When started, this will automatically create all resources and start
+# the containers. When stopped, this will teardown all resources.
+            systemd.targets."docker-compose-authentik-root" = {
+                unitConfig = {
+                    Description = "Root target generated by compose2nix.";
+                };
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}

modules/features/virtualization/docker/default.nix

@@ -0,0 +1,58 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.docker = {
+            enable = with lib; mkOption {
+                type = with types; bool;
+                default = false;
+            };
+
+            nvidia = with lib; mkOption {
+                type = with types; bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.docker.enable {
+
+            networking.nat.internalInterfaces = [ "docker0" "docker-main" ];
+
+            virtualisation = {
+                docker = {
+                    enable = true;
+                    storageDriver = "btrfs";
+                };
+
+                oci-containers = {
+                    backend = "docker";
+                };
+            };
+
+            hardware.nvidia-container-toolkit.enable = config.sysconfig.docker.nvidia;
+
+            systemd.services."docker-network-setup" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                    ExecStop = "docker network rm -f docker-main";
+                };
+                script = ''
+                    docker network inspect docker-main ||
+                    docker network create -d bridge docker-main \
+                    --attachable --subnet 192.168.101.0/24 --ip-range 192.168.101.0/24 \
+                    --gateway 192.168.101.1 \
+                    -o "com.docker.network.bridge.name"="docker-main" \
+                    -o "com.docker.network.bridge.trusted_host_interfaces"="wt0:ve-netbird:ve-traefik"
+                    '';
+                wantedBy = [ "docker-net.target" ];
+            };
+
+            systemd.targets."docker-net" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}
+

modules/features/virtualization/docker/docker-mailserver/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/docker/gitea/default.nix

@@ -0,0 +1,154 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    subdomain = "gitea";
+
+    name = "gitea";
+
+    in {
+
+        options.sysconfig.docker."${name}".enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker."${name}".enable && config.sysconfig.docker.enable) {
+
+
+            virtualisation.oci-containers.containers."${name}" = {
+                image = "docker.gitea.com/gitea:1.25.4";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "3000";
+
+
+                    "traefik.tcp.routers.${name}-ssh.entrypoints" = "gitea-ssh";
+                    "traefik.tcp.routers.${name}-ssh.rule" = "HostSNI(`*`)";
+                    "traefik.tcp.routers.${name}-ssh.service" = "${name}-ssh";
+
+                    "traefik.tcp.services.${name}-ssh.loadbalancer.server.port" = "22";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.20"
+                ];
+
+                volumes = [
+                    "vol_gitea:/data"
+                ];
+
+                environment = {
+                };
+            };
+
+            virtualisation.oci-containers.containers."${name}-db" = {
+                image = "docker.io/library/postgres:14";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${name}-db";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.21"
+                ];
+
+                volumes = [
+                    "/etc/gitea/db:/var/lib/postgresql/data"
+                ];
+
+                environment = {
+                };
+            };
+
+            systemd.services."docker-gitea" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-gitea.service" 
+                        "docker-gitea-db.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-gitea.service" 
+                        "docker-gitea-db.service" 
+                ];
+                partOf = [
+                    "docker-compose-gitea-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-gitea-root.target"
+                ];
+            };
+
+            systemd.services."docker-gitea-db" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                ];
+                partOf = [
+                    "docker-compose-gitea-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-gitea-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-gitea" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_gitea || docker volume create vol_gitea --driver=local
+                    '';
+                partOf = [ "docker-compose-gitea-root.target" ];
+                wantedBy = [ "docker-compose-gitea-root.target" ];
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/home-assistant/configuration.yaml

@@ -0,0 +1,16 @@
+
+# Loads default set of integrations. Do not remove.
+default_config:
+
+# Load frontend themes from the themes folder
+frontend:
+  themes: !include_dir_merge_named themes
+
+automation: !include automations.yaml
+script: !include scripts.yaml
+scene: !include scenes.yaml
+
+http:
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 192.168.101.11

modules/features/virtualization/docker/home-assistant/default.nix

@@ -0,0 +1,61 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: let
+
+    subdomain = "hass";
+
+    name = "home-assistant";
+
+    in {
+
+        options.sysconfig.docker.home-assistant.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.home-assistant.enable && config.sysconfig.docker.enable) {
+
+            environment.etc."home-assistant/configuration.yaml".source = ./configuration.yaml;
+
+            virtualisation.oci-containers.containers.home-assistant = {
+                image = "ghcr.io/home-assistant/home-assistant:stable";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8123";
+                };
+
+                environment = {
+                    TZ = "America/Chicago";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.13"
+                ];
+
+                ports = [
+                ];
+
+                volumes = [
+                    "vol_home-assistant:/config/"
+                        "/etc/home-assistant/configuration.yaml:/config/configuration.yaml"
+                ];
+            };
+        };
+    };
+}

modules/features/virtualization/docker/jellyfin/default.nix

@@ -0,0 +1,120 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    subdomain = "watch";
+
+    name = "jellyfin";
+
+    in {
+
+        options.sysconfig.docker.jellyfin.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.jellyfin.enable && config.sysconfig.docker.enable) {
+
+            networking.firewall.allowedUDPPorts = [ 7359 ];
+
+            virtualisation.oci-containers.containers.jellyfin = {
+                image = "jellyfin/jellyfin:10.11.6";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                    "7359:7359/udp"
+                ];
+
+                volumes = [
+                    "vol_jellyfin-config:/config"
+                        "vol_jellyfin-cache:/cache"
+
+                        "/etc/jellyfin/media:/media"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8096";
+                };
+
+                extraOptions = lib.mkIf config.sysconfig.docker.nvidia [
+                    "--device=nvidia.com/gpu=all"
+                        "--ip=192.168.101.21"
+                ];
+
+                environment = {
+                    JELLYFIN_PublishedServerUrl = "https://${subdomain}.esotericbytes.com";
+                };
+            };
+
+            systemd.services."docker-jellyfin" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-jellyfin-config.service" 
+                        "docker-volume-jellyfin-cache.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-jellyfin-config.service" 
+                        "docker-volume-jellyfin-cache.service" 
+                ];
+                partOf = [
+                    "docker-compose-jellyfin-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-jellyfin-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-jellyfin-config" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_jellyfin-config || docker volume create vol_jellyfin-config --driver=local
+                    '';
+                partOf = [ "docker-compose-jellyfin-root.target" ];
+                wantedBy = [ "docker-compose-jellyfin-root.target" ];
+            };
+
+            systemd.services."docker-volume-jellyfin-cache" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_jellyfin-cache || docker volume create vol_jellyfin-cache --driver=local
+                    '';
+                partOf = [ "docker-compose-jellyfin-root.target" ];
+                wantedBy = [ "docker-compose-jellyfin-root.target" ];
+            };
+
+            systemd.targets."docker-compose-jellyfin-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/kiwix/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/docker/minecraft/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/docker/n8n/default.nix

@@ -0,0 +1,105 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    subdomain = "n8n";
+
+    name = "n8n";
+
+    in {
+
+        options.sysconfig.docker."${name}".enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker."${name}".enable && config.sysconfig.docker.enable) {
+
+
+            virtualisation.oci-containers.containers."${name}" = {
+                image = "docker.n8n.io/n8nio/n8n";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "5678";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.2"
+                ];
+
+                volumes = [
+                    "vol_n8n:/etc/n8n"
+                ];
+
+                environment = {
+                    GENERIC_TIMEZONE = "America/Chicago";
+                    TZ = "America/Chicago";
+                    N8N_DIAGNOSTICS_ENABLED = "false";
+                    N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
+                    N8N_TEMPLATES_ENABLED = "false";
+
+                    EXTERNAL_FRONTEND_HOOKS_URLS = "";
+                    N8N_DIAGNOSTICS_CONFIG_FRONTEND = "";
+                    N8N_DIAGNOSTICS_CONFIG_BACKEND = "";
+
+                    N8N_SECURE_COOKIE = "false";
+                };
+            };
+
+            systemd.services."docker-n8n" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-n8n.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-n8n.service" 
+                ];
+                partOf = [
+                    "docker-compose-n8n-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-n8n-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-n8n" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_n8n || docker volume create vol_n8n --driver=local
+                    '';
+                partOf = [ "docker-compose-n8n-root.target" ];
+                wantedBy = [ "docker-compose-n8n-root.target" ];
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/netbird/config/management.json

@@ -0,0 +1,27 @@
+{
+    "Stuns": [
+        {
+            "Proto": "udp",
+            "URI": "stun:vpn.esotericbytes.com:3478"
+        }
+    ],
+    "Relay": {
+        "Addresses": ["rels://vpn.esotericbytes.com:443"],
+        "CredentialsTTL": "24h",
+        "Secret": "0qSIu/S2sXHJbo0SyBNm4SFxAItRoPLKR4wjnW/Zsgc"
+    },
+    "Signal": {
+        "Proto": "https",
+        "URI": "vpn.esotericbytes.com:443"
+    },
+    "Datadir": "/var/lib/netbird",
+    "DataStoreEncryptionKey": "FZnQt+JqAC8GEXUSJwhrgo0vn4PoDetoAhjUx9nSJR0=",
+    "EmbeddedIdP": {
+        "Enabled": true,
+        "Issuer": "https://vpn.esotericbytes.com/oauth2",
+        "DashboardRedirectURIs": [
+            "https://vpn.esotericbytes.com/nb-auth",
+            "https://vpn.esotericbytes.com/nb-silent-auth"
+        ]
+    }
+}

modules/features/virtualization/docker/netbird/default.nix

@@ -0,0 +1,232 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.docker.netbird.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.netbird.enable && config.sysconfig.docker.enable) {
+
+            networking.firewall.allowedUDPPorts = [ 3478 ];
+
+            sops.secrets."netbird/secret_key" = {};
+
+            sops.templates."netbird-relay.env" = {
+                content = ''
+                    NB_AUTH_SECRET=${config.sops.placeholder."netbird/secret_key"}
+                NB_LOG_LEVEL=info
+                    NB_LISTEN_ADDRESS=:80
+                    NB_EXPOSED_ADDRESS=rels://vpn.esotericbytes.com:443
+                    NB_ENABLE_STUN=true
+                    NB_STUN_LOG_LEVEL=info
+                    NB_STUN_PORTS=3478
+                    '';
+            };
+
+            environment.etc."netbird/management.json".source = ./config/management.json;
+
+# Containers
+            virtualisation.oci-containers.containers."netbird-dashboard" = {
+                image = "netbirdio/dashboard:v2.30.1";
+                environment = {
+                    "AUTH_AUDIENCE" = "netbird-dashboard";
+                    "AUTH_AUTHORITY" = "https://vpn.esotericbytes.com/oauth2";
+                    "AUTH_CLIENT_ID" = "netbird-dashboard";
+                    "AUTH_CLIENT_SECRET" = "";
+                    "AUTH_REDIRECT_URI" = "/nb-auth";
+                    "AUTH_SILENT_REDIRECT_URI" = "/nb-silent-auth";
+                    "AUTH_SUPPORTED_SCOPES" = "openid profile email groups";
+                    "LETSENCRYPT_DOMAIN" = "none";
+                    "NETBIRD_MGMT_API_ENDPOINT" = "https://vpn.esotericbytes.com";
+                    "NETBIRD_MGMT_GRPC_API_ENDPOINT" = "https://vpn.esotericbytes.com";
+                    "NGINX_SSL_PORT" = "443";
+                    "USE_AUTH0" = "false";
+                };
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-dashboard.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-dashboard.priority" = "1";
+                    "traefik.http.routers.netbird-dashboard.rule" = "Host(`vpn.esotericbytes.com`)";
+                    "traefik.http.routers.netbird-dashboard.tls" = "true";
+                    "traefik.http.services.netbird-dashboard.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=dashboard"
+                        "--network=docker-main"
+                        "--ip=192.168.101.5"
+                ];
+            };
+            systemd.services."docker-netbird-dashboard" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-management" = {
+                image = "netbirdio/management:0.64.4";
+                volumes = [
+                    "/etc/netbird/management.json:/etc/netbird/management.json:rw"
+                        "netbird_netbird_management:/var/lib/netbird:rw"
+                ];
+                cmd = [ "--port" "80" "--log-file" "console" "--log-level" "info" "--disable-anonymous-metrics=false" "--single-account-mode-domain=netbird.selfhosted" "--dns-domain=netbird.selfhosted" "--idp-sign-key-refresh-enabled" ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-api.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-api.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/api`)";
+                    "traefik.http.routers.netbird-api.service" = "netbird-api";
+                    "traefik.http.routers.netbird-api.tls" = "true";
+                    "traefik.http.routers.netbird-mgmt-grpc.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-mgmt-grpc.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/management.ManagementService/`)";
+                    "traefik.http.routers.netbird-mgmt-grpc.service" = "netbird-mgmt-grpc";
+                    "traefik.http.routers.netbird-mgmt-grpc.tls" = "true";
+                    "traefik.http.routers.netbird-mgmt-ws.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-mgmt-ws.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/ws-proxy/management`)";
+                    "traefik.http.routers.netbird-mgmt-ws.service" = "netbird-mgmt-ws";
+                    "traefik.http.routers.netbird-mgmt-ws.tls" = "true";
+                    "traefik.http.routers.netbird-oauth2.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-oauth2.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/oauth2`)";
+                    "traefik.http.routers.netbird-oauth2.service" = "netbird-oauth2";
+                    "traefik.http.routers.netbird-oauth2.tls" = "true";
+                    "traefik.http.services.netbird-api.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-mgmt-grpc.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-mgmt-grpc.loadbalancer.server.scheme" = "h2c";
+                    "traefik.http.services.netbird-mgmt-ws.loadbalancer.server.port" = "80";
+                    "traefik.http.services.netbird-oauth2.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=management"
+                        "--network=docker-main"
+                        "--ip=192.168.101.4"
+                ];
+            };
+            systemd.services."docker-netbird-management" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-volume-netbird_netbird_management.service"
+                ];
+                requires = [
+                    "docker-volume-netbird_netbird_management.service"
+                ];
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-relay" = {
+                image = "netbirdio/relay:0.64.4";
+
+                environmentFiles = [ config.sops.templates."netbird-relay.env".path ];
+
+                ports = [
+                    "3478:3478/udp"
+                ];
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-relay.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-relay.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/relay`)";
+                    "traefik.http.routers.netbird-relay.tls" = "true";
+                    "traefik.http.services.netbird-relay.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=relay"
+                        "--network=docker-main"
+                        "--ip=192.168.101.3"
+                ];
+            };
+            systemd.services."docker-netbird-relay" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+            virtualisation.oci-containers.containers."netbird-signal" = {
+                image = "netbirdio/signal:0.64.4";
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.netbird-signal-grpc.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-signal-grpc.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/signalexchange.SignalExchange/`)";
+                    "traefik.http.routers.netbird-signal-grpc.service" = "netbird-signal-grpc";
+                    "traefik.http.routers.netbird-signal-grpc.tls" = "true";
+                    "traefik.http.routers.netbird-signal-ws.entrypoints" = "websecure";
+                    "traefik.http.routers.netbird-signal-ws.rule" = "Host(`vpn.esotericbytes.com`) && PathPrefix(`/ws-proxy/signal`)";
+                    "traefik.http.routers.netbird-signal-ws.service" = "netbird-signal-ws";
+                    "traefik.http.routers.netbird-signal-ws.tls" = "true";
+                    "traefik.http.services.netbird-signal-grpc.loadbalancer.server.port" = "10000";
+                    "traefik.http.services.netbird-signal-grpc.loadbalancer.server.scheme" = "h2c";
+                    "traefik.http.services.netbird-signal-ws.loadbalancer.server.port" = "80";
+                };
+                log-driver = "journald";
+                extraOptions = [
+                    "--network-alias=signal"
+                        "--network=docker-main"
+                ];
+            };
+            systemd.services."docker-netbird-signal" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                partOf = [
+                    "docker-compose-netbird-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-netbird-root.target"
+                ];
+            };
+
+# Volumes
+            systemd.services."docker-volume-netbird_netbird_management" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect netbird_netbird_management || docker volume create netbird_netbird_management
+                    '';
+                partOf = [ "docker-compose-netbird-root.target" ];
+                wantedBy = [ "docker-compose-netbird-root.target" ];
+            };
+
+# Root service
+# When started, this will automatically create all resources and start
+# the containers. When stopped, this will teardown all resources.
+            systemd.targets."docker-compose-netbird-root" = {
+                unitConfig = {
+                    Description = "Root target generated by compose2nix.";
+                };
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}

modules/features/virtualization/docker/nextcloud/default.nix

@@ -0,0 +1,118 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    subdomain = "cloud";
+
+    name = "nextcloud";
+
+    in {
+
+        options.sysconfig.docker.nextcloud.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.nextcloud.enable && config.sysconfig.docker.enable) {
+
+            virtualisation.oci-containers.containers."nextcloud-aio-mastercontainer" = {
+                image = "ghcr.io/nextcloud-releases/all-in-one:20260122_105751";
+
+                serviceName = "docker-nextcloud";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                ];
+
+                volumes = [
+                    "nextcloud_aio_mastercontainer:/mnt/docker-aio-config"
+                        "/run/docker.sock:/var/run/docker.sock:ro"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.routers.${name}.middlewares" = "nextcloud-chain";
+
+                    "traefik.http.middlewares.https-redirect.redirectScheme.scheme" = "https";
+
+                    "traefik.http.middlewares.nextcloud-secure-headers.headers.hostsProxyHeaders" = "X-Forwarded-Host";
+                    "traefik.http.middlewares.nextcloud-secure-headers.headers.referrerPolicy" = "same-origin";
+
+                    "traefik.http.middlewares.nextcloud-chain.chain.middlewares" = "https-redirect,nextcloud-secure-headers";
+
+
+#"traefik.http.services.${name}.loadbalancer.server.port" = "11000";
+                    "traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.101.1:11000";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.17"
+                ];
+
+                environment = {
+                    APACHE_PORT = "11000";
+                    APACHE_IP = "0.0.0.0";
+                    APACHE_ADDITIONAL_NETWORK = "docker-main";
+
+                    SKIP_DOMAIN_VALIDATION = "true";
+
+                    TALK_PORT = "3479";
+                };
+            };
+
+            systemd.services."docker-nextcloud" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-nextcloud.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-nextcloud.service" 
+                ];
+                partOf = [
+                    "docker-compose-nextcloud-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-nextcloud-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-nextcloud" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect nextcloud_aio_mastercontainer || docker volume create nextcloud_aio_mastercontainer --driver=local
+                    '';
+                partOf = [ "docker-compose-nextcloud-root.target" ];
+                wantedBy = [ "docker-compose-nextcloud-root.target" ];
+            };
+
+            systemd.targets."docker-compose-nextcloud-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/ollama/default.nix

@@ -0,0 +1,76 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    hostPort = 11434;
+
+    subdomain = "ollama";
+
+    name = "ollama";
+
+    in {
+
+        options.sysconfig.docker.ollama.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.ollama.enable && config.sysconfig.docker.enable) {
+
+            environment.systemPackages = with pkgs; [
+                ollama
+            ];
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+
+                "ve-openwebui" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.ollama = {
+                image = "ollama/ollama:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                    "${builtins.toString hostPort}:11434"
+                ];
+
+                volumes = [
+                    "vol_ollama:/root/.ollama"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.ollama.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "11434";
+                };
+
+                extraOptions = lib.mkIf config.sysconfig.docker.nvidia [
+                    "--device=nvidia.com/gpu=all"
+                        "--ip=192.168.101.22"
+                ];
+
+                environment = {
+                    OLLAMA_CONTEXT_LENGTH = lib.mkDefault "32000";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/docker/openwebui/default.nix

@@ -0,0 +1,99 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: let
+
+    subdomain = "ai";
+
+    name = "openwebui";
+
+    in {
+
+        options.sysconfig.docker.openwebui.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.openwebui.enable && config.sysconfig.docker.enable) {
+
+            virtualisation.oci-containers.containers.openwebui = {
+                image = "ghcr.io/open-webui/open-webui:v0.7.2";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                /*ports = [
+                  "${builtins.toString hostPort}:8080"
+                  ];*/
+
+                volumes = [
+                    "vol_openwebui:/app/backend/data"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8080";
+                };
+
+                extraOptions = lib.mkIf config.sysconfig.docker.nvidia [
+                    "--device=nvidia.com/gpu=all"
+                        "--ip=192.168.101.8"
+                ];
+
+                environment = {
+                };
+            };
+
+            systemd.services."docker-openwebui" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                        "docker-volume-openwebui.service" 
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                        "docker-volume-openwebui.service" 
+                ];
+                partOf = [
+                    "docker-compose-openwebui-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-openwebui-root.target"
+                ];
+            };
+
+            systemd.services."docker-volume-openwebui" = {
+                path = [ pkgs.docker ];
+                serviceConfig = {
+                    Type = "oneshot";
+                    RemainAfterExit = true;
+                };
+                script = ''
+                    docker volume inspect vol_openwebui || docker volume create vol_openwebui --driver=local
+                    '';
+                partOf = [ "docker-compose-openwebui-root.target" ];
+                wantedBy = [ "docker-compose-openwebui-root.target" ];
+            };
+
+            systemd.targets."docker-compose-openwebui-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+
+        };
+    };
+}

modules/features/virtualization/docker/passbolt/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/docker/passbolt/docker-compose.nix-txt

@@ -0,0 +1,167 @@
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."passbolt-db" = {
+    image = "mariadb:10.11";
+    environment = {
+      "MYSQL_DATABASE" = "passbolt";
+      "MYSQL_PASSWORD" = "P4ssb0lt";
+      "MYSQL_RANDOM_ROOT_PASSWORD" = "true";
+      "MYSQL_USER" = "passbolt";
+    };
+    volumes = [
+      "passbolt_database_volume:/var/lib/mysql:rw"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=db"
+      "--network=passbolt_default"
+    ];
+  };
+  systemd.services."docker-passbolt-db" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_database_volume.service"
+    ];
+    requires = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_database_volume.service"
+    ];
+    partOf = [
+      "docker-compose-passbolt-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-passbolt-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."passbolt-passbolt" = {
+    image = "passbolt/passbolt:latest-ce";
+    environment = {
+      "APP_FULL_BASE_URL" = "https://passbolt.local";
+      "DATASOURCES_DEFAULT_DATABASE" = "passbolt";
+      "DATASOURCES_DEFAULT_HOST" = "db";
+      "DATASOURCES_DEFAULT_PASSWORD" = "P4ssb0lt";
+      "DATASOURCES_DEFAULT_USERNAME" = "passbolt";
+    };
+    volumes = [
+      "passbolt_gpg_volume:/etc/passbolt/gpg:rw"
+      "passbolt_jwt_volume:/etc/passbolt/jwt:rw"
+    ];
+    ports = [
+      "80:80/tcp"
+      "443:443/tcp"
+    ];
+    cmd = [ "/usr/bin/wait-for.sh" "-t" "0" "db:3306" "--" "/docker-entrypoint.sh" ];
+    dependsOn = [
+      "passbolt-db"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=passbolt"
+      "--network=passbolt_default"
+    ];
+  };
+  systemd.services."docker-passbolt-passbolt" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_gpg_volume.service"
+      "docker-volume-passbolt_jwt_volume.service"
+    ];
+    requires = [
+      "docker-network-passbolt_default.service"
+      "docker-volume-passbolt_gpg_volume.service"
+      "docker-volume-passbolt_jwt_volume.service"
+    ];
+    partOf = [
+      "docker-compose-passbolt-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-passbolt-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."docker-network-passbolt_default" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "docker network rm -f passbolt_default";
+    };
+    script = ''
+      docker network inspect passbolt_default || docker network create passbolt_default
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."docker-volume-passbolt_database_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_database_volume || docker volume create passbolt_database_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+  systemd.services."docker-volume-passbolt_gpg_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_gpg_volume || docker volume create passbolt_gpg_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+  systemd.services."docker-volume-passbolt_jwt_volume" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      docker volume inspect passbolt_jwt_volume || docker volume create passbolt_jwt_volume
+    '';
+    partOf = [ "docker-compose-passbolt-root.target" ];
+    wantedBy = [ "docker-compose-passbolt-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-passbolt-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

modules/features/virtualization/docker/pihole/default.nix

@@ -0,0 +1,85 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: let
+
+    hostPort = 9001;
+
+    subdomain = "pihole";
+
+    name = "pihole";
+
+    in {
+
+        options.sysconfig.docker.pihole.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.pihole.enable && config.sysconfig.docker.enable) {
+
+            virtualisation.docker.daemon.settings.dns = [ "192.168.101.12" ];
+
+            environment.etc."resolv.conf" = {
+                enable = true;
+                text = ''
+                    nameserver 127.0.0.1
+                    nameserver 1.1.1.1
+                    nameserver 1.0.0.1
+                    options edns0
+                    '';
+
+                user = "root";
+                mode = "0664";
+            };
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.pihole = {
+                image = "pihole/pihole:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "80";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.12"
+                ];
+
+                ports = [
+                    "${builtins.toString hostPort}:80"
+                        "127.0.0.1:53:53/tcp"
+                        "127.0.0.1:53:53/udp"
+                ];
+
+                volumes = [
+                    "vol_pihole:/etc/pihole"
+                ];
+
+                environment = {
+                    FTLCONF_webserver_api_password = "7567";
+                    FTLCONF_dns_listeningMode = "ALL";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/docker/portainer/default.nix

@@ -0,0 +1,65 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: let
+
+    hostPort = 9000;
+
+    subdomain = "portainer";
+
+    name = "portainer";
+
+    in {
+
+        options.sysconfig.docker.portainer.enable = with lib; mkOption {
+            type = with types; bool;
+            default = true;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.portainer.enable && config.sysconfig.docker.enable) {
+
+            networking.firewall.interfaces = {
+                "ve-traefik" = {
+                    allowedTCPPorts = [ hostPort ];
+                };
+            };
+
+            virtualisation.oci-containers.containers.portainer = {
+                image = "portainer/portainer-ce:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "9000";
+                };
+
+                ports = [
+                    "127.0.0.1:8000:8000"
+                        "${builtins.toString hostPort}:9000"
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.10"
+                ];
+
+                volumes = [
+                    "vol_portainer:/data"
+                        "/run/docker.sock:/var/run/docker.sock"
+                ];
+            };
+        };
+    };
+}

modules/features/virtualization/docker/rustdesk/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/docker/rustdesk/docker-compose.nix-txt

@@ -0,0 +1,77 @@
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."hbbr" = {
+    image = "rustdesk/rustdesk-server:latest";
+    volumes = [
+      "/home/nathan/Projects/Olympus/system/virtualization/docker/rustdesk/data:/root:rw"
+    ];
+    cmd = [ "hbbr" ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network=host"
+    ];
+  };
+  systemd.services."docker-hbbr" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    partOf = [
+      "docker-compose-rustdesk-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-rustdesk-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."hbbs" = {
+    image = "rustdesk/rustdesk-server:latest";
+    volumes = [
+      "/home/nathan/Projects/Olympus/system/virtualization/docker/rustdesk/data:/root:rw"
+    ];
+    cmd = [ "hbbs" ];
+    dependsOn = [
+      "hbbr"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network=host"
+    ];
+  };
+  systemd.services."docker-hbbs" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    partOf = [
+      "docker-compose-rustdesk-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-rustdesk-root.target"
+    ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-rustdesk-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

modules/features/virtualization/docker/searxng/default.nix

@@ -0,0 +1,62 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: let
+
+    subdomain = "searxng";
+
+    name = "searxng";
+
+    in {
+
+        options.sysconfig.docker.searxng.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.searxng.enable && config.sysconfig.docker.enable) {
+
+            environment.etc."searxng/settings.yml".source = ./settings.yml;
+
+            virtualisation.oci-containers.containers.searxng = {
+                image = "searxng/searxng:latest";
+
+# unstable, waiting for 26.05
+#pull = "newer";
+
+                hostname = "${subdomain}.esotericbytes.com";
+
+                networks = [
+                    "docker-main"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
+                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
+                    "traefik.http.routers.${name}.service" = "${name}";
+                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";
+
+#"traefik.http.services.${name}.loadbalancer.server.url" = "http://192.168.100.10:${builtins.toString hostPort}";
+                    "traefik.http.services.${name}.loadbalancer.server.port" = "8080";
+                };
+
+                ports = [
+                ];
+
+                extraOptions = [
+                    "--ip=192.168.101.9"
+                ];
+
+                volumes = [
+                    "vol_searxng_settings:/etc/searxng/"
+                        "vol_searxng_data:/var/cache/searxng/"
+                        "/etc/searxng/settings.yml:/etc/searxng/settings.yml"
+                ];
+
+                environment = {
+                    SEARXNG_SECRET = "2e8b4fcf4c0f46b097496f2d5715dbb061bd5cac78c64d0f5a0bee27f013f3c0";
+                };
+            };
+        };
+    };
+}

modules/features/virtualization/docker/traefik/config/routing.yml

@@ -0,0 +1,75 @@
+http: 
+  routers: 
+    
+    homepageSecure: 
+      entryPoints: 
+        - "websecure" 
+        - "localsecure"
+      rule: "Host(`esotericbytes.com`) || Host(`www.esotericbytes.com`)"
+      service: "homepage"
+      middlewares:
+        - authentik
+      tls:
+        certResolver: "cloudflare"
+    
+    code-server: 
+      entryPoints: 
+        - "localsecure"
+      rule: "Host(`code.esotericbytes.com`)"
+      service: "code-server"
+      tls:
+        certResolver: "cloudflare"
+
+    gitea: 
+      entryPoints: 
+        - "localsecure"
+        - "websecure"
+      rule: "Host(`gitea.esotericbytes.com`)"
+      service: "gitea"
+      tls:
+        certResolver: "cloudflare"
+
+    octoprint:
+      entryPoints:
+        - "localsecure"
+        #- "websecure"
+      rule: "Host(`3dp.esotericbytes.com`)"
+      service: "octoprint"
+      tls:
+        certResolver: "cloudflare"
+
+  services: 
+    homepage:
+      loadBalancer:
+        servers: 
+          - url: "http://192.168.100.13:80"
+      
+    code-server:
+      loadBalancer:
+        servers: 
+          - url: "http://192.168.100.31:4444"
+    
+    gitea:
+      loadBalancer:
+        servers: 
+          - url: "http://192.168.100.20:3000"
+    
+    octoprint:
+      loadBalancer:
+        servers:
+          - url: "http://rpi-3dp.local"
+        passHostHeader: true
+
+tcp:
+  routers:
+    gitea-ssh:
+      entryPoints:
+        - "gitea-ssh"
+      rule: "HostSNI(`*`)"
+      service: "gitea-ssh"
+
+  services:
+    gitea-ssh:
+      loadBalancer:
+        servers:
+          - address: "192.168.100.20:2222"

modules/features/virtualization/docker/traefik/config/traefik.yml

@@ -0,0 +1,87 @@
+providers:
+  docker:
+    exposedByDefault: false
+  file:
+    filename: "/etc/traefik/routing.yml"
+
+serversTransport:
+  insecureSkipVerify: true
+
+api: 
+  dashboard: true
+
+global: 
+  checknewversion: true
+  sendanonymoususage: false
+
+entryPoints: 
+  web: 
+    address: ":81"
+    http:
+      redirections:
+        entryPoint: 
+          to: "websecure"
+          scheme: "https"
+
+  websecure: 
+    address: ":444"
+    asDefault: true
+    transport:
+      respondingTimeouts:
+        readTimeout: 24h
+    http:
+      tls: 
+        certResolver: "cloudflare"
+        domains: 
+          main: "esotericbytes.com"
+          sans:
+            - "*.esotericbytes.com" 
+      encodedCharacters:  
+        allowEncodedSlash: true
+        allowEncodedQuestionMark: true
+        allowEncodedPercent: true
+  
+  local: 
+    address: ":80"
+    http:
+      redirections:
+        entryPoint: 
+          to: "localsecure"
+          scheme: "https"
+
+  localsecure: 
+    address: ":443"
+    asDefault: true
+    transport:
+      respondingTimeouts:
+        readTimeout: 24h
+    http:
+      tls: 
+        certResolver: "cloudflare"
+        domains: 
+          main: "esotericbytes.com"
+          sans:
+            - "*.esotericbytes.com" 
+      encodedCharacters:  
+        allowEncodedSlash: true
+        allowEncodedQuestionMark: true
+        allowEncodedPercent: true
+  gitea-ssh:
+    address: ":2222"
+
+log: 
+  level: "INFO"
+  filePath: "/etc/traefik/logs/traefik.log"
+  format: "json"
+
+certificatesResolvers: 
+  cloudflare: 
+    acme: 
+      storage: "/etc/traefik/acme.json"
+      keyType: "EC256"
+      dnsChallenge: 
+        provider: "cloudflare"
+        resolvers:
+          - "1.1.1.1:53" 
+          - "1.0.0.1:53"
+

modules/features/virtualization/docker/traefik/default.nix

@@ -0,0 +1,111 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.docker.traefik.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf (config.sysconfig.docker.traefik.enable && config.sysconfig.docker.enable) {
+
+            networking.firewall.allowedTCPPorts = [ 80 81 443 444 2222 ];
+
+            sops.secrets = {
+                "traefik/cf_email" = {};
+                "traefik/cf_api_key" = {};
+            };
+
+            sops.templates."traefik.env" = {
+                content = ''
+                    CF_API_EMAIL=${config.sops.placeholder."traefik/cf_email"}
+                CF_DNS_API_TOKEN=${config.sops.placeholder."traefik/cf_api_key"}
+                '';
+            };
+
+            environment.etc = (builtins.listToAttrs (builtins.map (x: { 
+                            name = "traefik/${x}"; 
+                            value = {
+                            source = ./config/${x};
+                            mode = "0664";
+                            };
+                            }) (builtins.attrNames (builtins.readDir ./config))));
+
+            /*environment.etc."traefik/traefik.yml" = {
+              source = ./config/traefik.yml;
+              };
+              environment.etc."traefik/routing.yml" = {
+              source = ./config/routing.yml;
+              };*/
+
+            virtualisation.oci-containers.containers.traefik = {
+
+                image = "traefik:v3.6";
+
+                environment = {
+                    TRAEFIK_CERTIFICATESRESOLVERS_CLOUDFLARE_ACME_EMAIL = "\${CF_API_EMAIL}";
+                };
+
+                environmentFiles = [ config.sops.templates."traefik.env".path ];
+
+                volumes = [
+                    "/etc/traefik/:/etc/traefik/"
+                        "/run/docker.sock:/var/run/docker.sock" 
+                ];
+
+                networks = [
+                    "docker-main"
+                ];
+
+                ports = [
+                    "80:80"
+                        "81:81"
+                        "443:443"
+                        "444:444"
+                        "2222:2222"
+                ];
+
+                labels = {
+                    "traefik.enable" = "true";
+                    "traefik.http.routers.dashboard.rule" = "Host(`traefik.esotericbytes.com`)";
+                    "traefik.http.routers.dashboard.entrypoints" = "websecure,localsecure";
+                    "traefik.http.routers.dashboard.service" = "api@internal";
+                    "traefik.http.routers.dashboard.tls.certResolver" = "cloudflare";
+                };
+
+                extraOptions = [
+                    "--ip=192.168.101.11"
+                ];
+
+                log-driver = "journald";
+            };
+            systemd.services."docker-traefik" = {
+                serviceConfig = {
+                    Restart = lib.mkOverride 90 "always";
+                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
+                    RestartSec = lib.mkOverride 90 "100ms";
+                    RestartSteps = lib.mkOverride 90 9;
+                };
+                after = [
+                    "docker-network-setup.service"
+                ];
+                requires = [
+                    "docker-network-setup.service"
+                ];
+                partOf = [
+                    "docker-compose-traefik-root.target"
+                ];
+                wantedBy = [
+                    "docker-compose-traefik-root.target"
+                ];
+            };
+
+# Root service
+# When started, this will automatically create all resources and start
+# the containers. When stopped, this will teardown all resources.
+            systemd.targets."docker-compose-traefik-root" = {
+                wantedBy = [ "multi-user.target" ];
+            };
+        };
+    };
+}

modules/features/virtualization/docker/wyoming/default.nix

@@ -0,0 +1 @@
+{}

modules/features/virtualization/virtual-machines/default.nix

@@ -0,0 +1,27 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, pkgs, ... }: {
+
+        options.sysconfig.virtual-machines.enable = with lib; mkOption {
+            type = with types; bool;
+            default = false;
+        };
+
+        config = lib.mkIf config.sysconfig.virtual-machines.enable {
+            programs.virt-manager.enable = true;
+
+            virtualisation = {
+                libvirtd = {
+                    enable = true;
+                    qemu.swtpm.enable = true;
+                };
+
+                spiceUSBRedirection.enable = true;
+            };
+
+            environment.systemPackages = with pkgs; lib.mkIf config.sysconfig.graphical [
+                virt-viewer
+            ];
+        };
+    };
+}

modules/features/virtualization/virtual-machines/home-assistant/default.nix

@@ -0,0 +1,17 @@
+{ ... }: {
+
+    flake.nixosModules.default = { config, lib, ... }: {
+
+        options.sysconfig.virtual-machines.home-assistant = {
+            enable = lib.options.mkOption {
+                type = lib.types.bool;
+                default = false;
+            };
+        };
+
+        config = lib.mkIf config.sysconfig.virtual-machines.home-assistant.enable {
+
+        };
+    };
+}
+